CVE-2025-48113: Broadstreet Ads Stored XSS Vulnerability

CVE-2025-48113 Overview

CVE-2025-48113 is a stored cross-site scripting (XSS) vulnerability in the Broadstreet Ads WordPress plugin. The flaw affects all versions up to and including 1.51.2. The plugin fails to properly neutralize user-supplied input during web page generation, allowing authenticated attackers to inject persistent JavaScript payloads. Stored payloads execute in the browsers of users who view the affected pages, enabling session theft, forced administrative actions, or redirection to attacker-controlled resources. The vulnerability is classified under [CWE-79] and has a scope-changed impact, meaning injected scripts can affect resources beyond the vulnerable component itself.

Critical Impact
Authenticated attackers with low privileges can inject persistent scripts that execute against site visitors and administrators, potentially leading to account takeover of higher-privileged users.

Affected Products

Broadstreet Ads WordPress plugin, all versions through 1.51.2
WordPress sites running the vulnerable broadstreet plugin
Any site permitting contributor-level or higher accounts to interact with plugin inputs

Discovery Timeline

2025-05-16 - CVE-2025-48113 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-48113

Vulnerability Analysis

The vulnerability stems from improper neutralization of user input rendered into HTML output by the Broadstreet Ads plugin. When an authenticated user submits content through an affected plugin field, the plugin stores that content without sufficient sanitization or output encoding. Later, when the stored data is rendered into a WordPress page or administrative view, the browser interprets injected markup as executable code.

Stored XSS differs from reflected XSS in persistence. The payload lives in the site database and executes for every user who loads the affected view. This creates repeatable, wormable conditions where a single injection can compromise multiple accounts. Because the CVSS scope is marked as changed, injected scripts can act against browser contexts outside the vulnerable component, including the WordPress administrative interface.

Root Cause

The root cause is missing or incomplete input sanitization and output encoding in the Broadstreet Ads plugin code paths that accept and render user-controlled fields. WordPress provides functions such as wp_kses, esc_html, and esc_attr for safe rendering, but the affected plugin versions do not apply them consistently to the vulnerable input.

Attack Vector

An attacker with at least low-privileged authenticated access submits a crafted payload containing HTML or JavaScript into a plugin input field. The payload is stored in the WordPress database. When an administrator or site visitor loads a page that renders the stored value, the injected script executes in their browser session. Successful exploitation requires user interaction, such as viewing the affected page. Attackers commonly use this pattern to exfiltrate session cookies, issue administrative requests via cross-site request forgery, or pivot to persistent backdoors by creating new administrator accounts.

See the Patchstack WordPress Vulnerability Report for technical details.

Detection Methods for CVE-2025-48113

Indicators of Compromise

Unexpected <script> tags, event handlers such as onerror= or onload=, or javascript: URIs stored in Broadstreet plugin database tables
New or modified WordPress administrator accounts created shortly after low-privileged user activity
Outbound requests from administrator browser sessions to unfamiliar domains following visits to Broadstreet-managed pages
Anomalous entries in WordPress wp_options or plugin-specific tables containing HTML markup

Detection Strategies

Query the WordPress database for stored fields containing script tags, on*= event handlers, or encoded JavaScript within Broadstreet plugin records
Review web server access logs for POST requests to Broadstreet plugin endpoints originating from low-privileged accounts
Inspect browser Content Security Policy (CSP) violation reports for script execution attempts on WordPress admin pages

Monitoring Recommendations

Enable WordPress audit logging to record content changes made by contributor and author roles
Monitor for creation of new administrative users and unexpected role escalations
Alert on outbound HTTP requests from administrative sessions to domains not on an allowlist
Track plugin version inventory across WordPress deployments to identify vulnerable Broadstreet Ads installations

How to Mitigate CVE-2025-48113

Immediate Actions Required

Update the Broadstreet Ads plugin to a version released after 1.51.2 as soon as the vendor publishes a fixed release
Audit all user accounts and remove unused contributor, author, or editor accounts that could be abused for injection
Review Broadstreet plugin database records for existing stored payloads and sanitize any suspicious entries
Rotate WordPress administrator credentials and invalidate active sessions if compromise is suspected

Patch Information

Refer to the Patchstack WordPress Vulnerability Report for the current patch status and updated version guidance. Apply the vendor-supplied update through the WordPress plugin manager when available.

Workarounds

Deactivate the Broadstreet Ads plugin until a patched version is installed
Restrict plugin access to trusted administrator accounts only and remove low-privileged users from Broadstreet-related capabilities
Deploy a Web Application Firewall (WAF) rule to block requests containing script tags or common XSS payloads targeting Broadstreet plugin endpoints
Implement a strict Content Security Policy on the WordPress site to limit script execution sources

bash

# Example Content Security Policy header for WordPress
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'"